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We use the class of commuting quantum computations known as IQP (Instantaneous Quantum Polynomial 
time) to strengthen the conjecture that quantum computers are hard to simulate classically. We show that, if 
either of two plausible average-case hardness conjectures holds, then IQP computations are hard to simulate 
classically up to constant additive error. One conjecture relates to the hardness of estimating the complex- 
temperature partition function for random instances of the Ising model; the other concerns approximating the 
number of zeroes of random low-degree polynomials. We observe that both conjectures can be shown to be valid 
in the setting of worst-case complexity. We arrive at these conjectures by deriving spin-based generalisations of 
the Boson Sampling problem that avoid the so-called permanent anticoncentration conjecture. 


Quantum computers are conjectured to outperform classi¬ 
cal computers for a variety of important tasks ranging from 
integer factorisation [1] to the simulation of quantum me¬ 
chanics [2]. However, to date there is relatively little rigor¬ 
ous evidence for this conjecture. It is well established that 
quantum computers can yield an exponential advantage in 
the query and communication complexity models. But in the 
more physically meaningful model of time complexity, there 
are no proven separations known between quantum and clas¬ 
sical computation. 

This can be seen as a consequence of the extreme difficulty 
of proving bounds on the power of classical computing mod¬ 
els, such as the famous P vs. NP problem. Given this diffi¬ 
culty, the most we can reasonably hope for is to show that 
quantum computations cannot be simulated efficiently clas¬ 
sically, assuming some widely believed complexity-theoretic 
conjecture. For example, any set of quantum circuits that can 
implement Shor’s algorithm [1] provides a canonical example, 
with the unlikely consequence of efficient classical simulation 
of this class of quantum circuits being the existence of an effi¬ 
cient classical factoring algorithm. However, one could hope 
for the existence of other examples that have wider-reaching 
complexity-theoretic consequences. 

With this in mind, in both [3] and [4] it was shown that the 
existence of an efficient classical sampler from a distribution 
that is close to the output distribution of an arbitrary quantum 
circuit, to within a small multiplicative error in each output 
probability, would imply that post-selected classical computa¬ 
tion is equivalent to post-selected quantum computation. This 
consequence is considered very unlikely as it would collapse 
the infinite tower of complexity classes known as the Polyno¬ 
mial Hierarchy [5] to its third level. In both works this was 
proven even for non-universal quantum circuit families; com¬ 
muting quantum circuits in the case of [3], and linear-optical 
networks in [4]. These non-universal families are of physi¬ 
cal interest because they are simpler to implement, and easier 
to analyse because of the elegant mathematical structures on 
which they are based. 
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Unfortunately, this notion of approximate sampling is phys¬ 
ically unrealistic: it is more reasonable to allow the quantum 
computer, and its corresponding classical simulator, to sam¬ 
ple from a distribution which is close to the quantum circuit’s 
output distribution in total variation distance (or equivalently 
the £i distance). The results of [3, 4] have little meaning in 
this “additive error” setting. 

One important recent step to addressing this was proposed 
by Aaronson and Arkhipov [4], who gave a sophisticated 
argument based on counting complexity that approximately 
sampling from the output probability distribution of a ran¬ 
domly chosen network of noninteracting photons (a problem 
known as Boson Sampling) should be classically hard, even 
up to a reasonable additive error bound. This major break¬ 
through rests on two tantalising but as yet unproven conjec¬ 
tures: the so-called permanent anticoncentration conjecture 
and the permanent-of-Gaussians conjecture. 

In this paper we propose a generalisation of the Boson Sam¬ 
pling argument of [4] that is native to spin systems, specifi¬ 
cally to randomly chosen commuting quantum circuits from 
the class known as IQP (Instantaneous Quantum Polynomial 
time), which was introduced in [6] and [3]. In our opinion this 
leads to a mathematically simpler setting, while still retaining 
the essential complexity-theoretic ingredients. This simplic¬ 
ity allows us to prove the IQP analogues of the permanent 
anticoncentration conjecture. The only remaining conjecture 
to prove is an IQP analogue of the permanent-of-Gaussians 
conjecture, of which we find two natural examples. 

Informally (see [3, 6] for the formal definition) an n-qubit 
IQP circuit C is a quantum circuit which takes as input the 
state |0)®", whose gates are diagonal in the Pauli-X basis, 
and whose n-qubit output is measured in the computational 
basis. It is often convenient to write C = ff^nQpj^n^ where 
C is diagonal in the Pauli-Z basis and H is the usual Hadamard 
gate. We can now state the main result of this paper; 

Theorem 1. Assume either Conjecture 2 or 3 below is true. If 
it is possible to classically sample from the output probability 
distribution of any IQP circuit C in polynomial time, up to an 
error of 1/192 in fi norm, then there is a BPP^^ algorithm to 
solve any problem in P"^^. Hence the Polynomial Hierarchy 
would collapse to its third level. 
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Loosely speaking, the complexity class appearing in 
this theorem is the class of problems that can be solved in 
polynomial time given the ability to count the number of solu¬ 
tions of arbitrary NP problems [5]; BPP^^ is the class of prob¬ 
lems that can be solved by randomised classical polynomial¬ 
time computation equipped with an oracle that can solve any 
problem in NP. 

Theorem 1 is based around two natural conjectures, one 
of which is native to computer science, and other common 
in condensed-matter physics. Both conjectures are concerned 
with the complexity of computing multiplicative approxima¬ 
tions to output probabilities, |(0|®"C|0)®"p, of circuits that 
are randomly chosen from circuit families within IQP. We 
say that is a multiplicative approximation of X to within 
rj if \A — X\ < rjX. Essentially, Theorem 1 states that if 
we assume either of our conjectures, then there is no way of 
classically efficiently sampling the outputs of these families of 
quantum circuits without a major re-evaluation of the existing 
status-quo of complexity theory. 

The first conjecture is based on the complexity of one of 
the most commonly studied models of statistical physics, the 
Ising model. Consider the partition function 

Z{uj)= (1) 

where the exponentiated sum is over the complete graph on n 
vertices, Wij and Vk are real edge and vertex weights, and oj G 
C. Then, for any w = e*®, Z(aj) arises straightforwardly as 
an amplitude of some IQP circuit C/(w): (0|®”C/(a;)|0)®” = 
Z(w)/2" (see Appendix A and [7-11]). For our purposes it 
is sufficient to restrict to the case where uj — and the 

weights are picked by choosing uniformly at random from the 
set {0,..., 7} on the vertices and edges of the complete graph 
on n vertices. Our results would still apply for many other 
choices for cc and the weights (for example, the edge weights 
can be picked uniformly from {0,..., 3}). 

The diagonal component of the corresponding circuits 
^^(gZ7r/8) constructed from VCZ (square-root of 

Controlled-Z, i.e. diag(l, 1,1, i)), and T = ( q gi !?/4 ) gates, 
or alternatively by applying the Ising interaction directly. The 
number of applications of each gate is given by a simple func¬ 
tion of the edge and vertex weights of the associated graph in 
such a way that random edge weights correspond to a random 
circuit (see the end of Appendix F). See Figure 1 for an ex¬ 
ample. Let Zfi denote partition functions associated with this 
random choice of weights. 

Conjecture 2. It is #P-hard to approximate \Ziff up to mul¬ 
tiplicative error 1/4-1- o(l)/or a 1/24 fraction of instances 
over the choice of vertex and edge weights. 

It is known that the family of partition functions Z{lo) 
parametrised as above is #P-hard to compute in the worst case 
up to the above multiplicative error bound [10, 11]. Conjec¬ 
ture 2 thus states that this worst-case hardness result can be 
improved to an average-case hardness result. 

Our second conjecture is based on the hardness of comput¬ 
ing the gap of degree-3 polynomials over F 2 , / : {0,1}" — 



FIG. 1. An example of a randomly chosen circuit Ci corresponding 
to a 4-qubit Ising model instance such that (0|®’®C/|0)®" = Zr/2" 
(up to trivial phase factors). Assuming Conjecture 2 is true, if there 
exists a classically efficient algorithm for sampling from the output 
of any such (n-qubit) circuit to within a constant additive error, then 
the Polynomial Hierarchy collapses. 

{0,1}, which are expressible (up to an additive constant) as 
fix') ^ ^ (XijkXiXjXf^ -f 'y ^ fiijX^Xj -f ^ ^ (mod 2), 

i,j,k i,j i 

where G {0,1}. The gap is defined by gap(/) := 

|{a; : f{x) = 0}| — \{x : f{x) = 1}|. It can be shown that, 
for any degree-3 polynomial /, (0|®”C/|0)®” = gap(/)/2” 
for IQP circuits C / whose diagonal component is constructed 
from Z, CZ, and CCZ gates for the degree 1-3 terms respec¬ 
tively (see Appendix B). We write ngap(/) = gap(/)/2". 
Then we have the following conjecture: 

Conjecture 3. Let f : {0,1}" —{0,1} be a uniformly ran¬ 
dom degree-3 polynomial over F 2 . Then it is #P-hard to ap¬ 
proximate ngap(/)^ up to a multiplicative error of l/4-\-oil) 
fora 1/24 fraction of polynomials f. 

It has been known for some time that ngap(/) is #P-hard 
to compute exactly in the worst case [12]. We show in Ap¬ 
pendix D, using IQP techniques, that this worst-case hardness 
still holds for approximating ngap(/)^ up to multiplicative er¬ 
ror less than 1 /2. Just as with Conjecture 2, what remains is to 
lift this worst-case hardness result to average-case hardness. 

We remark that an additional piece of evidence provided 
in [4] for the average-case hardness of multiplicative approxi¬ 
mations to Boson Sampling (the permanent-of-Gaussians con¬ 
jecture) was a direct proof that exact simulation of Boson 
Sampling probability distributions is hard on average. This 
was based on average-case hardness results for computation 
of the permanent, for which we do not know IQP analogues. 
However, currently known techniques do not seem sufficient 
to extend these exact average-case hardness results for Boson 
Sampling to approximate hardness results [4, Section 9.2]. 

As with the case of Boson Sampling, the worst-case hard¬ 
ness of multiplicative approximations to both Z{uj) and 
ngap(/) ([11] and Appendix D) implies via standard results 
on random-self-reducibility [13] that there exists some distri¬ 
bution over the choices of these functions that is #P-hard on 
average - but not necessarily the distributions that we require 
for Conjectures 2 and 3. 

Interestingly, recent independent work of Fefferman and 
Umans [14] has explored an alternative way to generalise the 
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ideas of Aaronson and Arkhipov [4]. This work uses Quan¬ 
tum Fourier Sampling to construct states whose correspond¬ 
ing probability distributions are hard to sample from classi¬ 
cally, under similar conjectures to [4]. An appealing aspect of 
the construction of [14] is that it shows that there are specific, 
and rather simple, quantum states which are hard to simulate 
classically, assuming an anticoncentration conjecture holds. 
However, constructing these states appears to require the full 
power of quantum computation, unlike the results described 
here and in [4] . 

Intuition - There are a number of technical ingredients of 
Theorem 1 which will be discussed in full below. The basic 
idea is that, for the class of problems underlying Conjectures 2 
and 3, any classical IQP sampler that is accurate up to a good 
additive error bound in the worst case, is forced to also be ac¬ 
curate to within a reasonable multiplicative error on average. 
This observation is combined with a classic result of complex¬ 
ity theory, the so-called Stockmeyer counting algorithm ([15] 
and Appendix E), which can be used to estimate individual 
output probabilities of a classical sampler up to small multi¬ 
plicative error. 

Some ingredients essential to the result are anticoncentra¬ 
tion results for ngap(/) (for Conjecture 3) and the partition 
function of the random Ising model (for Conjecture 2). That 
such anticoncentration results can be proven is a consequence 
of the elegant mathematical structures upon which IQP cir¬ 
cuits are based. 

Putting these observations together, we find that there is an 
FBpp^P algorithm for computing a multiplicative approxima¬ 
tion to a large fraction of and ngap(/)^. Assuming the 
Conjectures 2 and 3, and that the Polynomial Hierarchy does 
not collapse, this implies that randomly chosen circuits from 
Ci and C / cannot be classically simulated. 

We remark that the gate sets Cj and Cf would be universal 
if we could also perform Hadamard (H) gates at any point in 
the circuit - which we cannot do in IQP because this gate does 
not commute with the X gate. However, if we allow the un¬ 
physical resource of postselection, these Hadamard gates can 
effectively be implemented [3], allowing IQP circuit ampli¬ 
tudes {y\C\x) to express any quantum circuit amplitude (up to 
a known constant). See Appendix C for a description of this 
construction. A consequence is that classical computation of 
such amplitudes is #P-hard, even up to constant multiplicative 
error [3, 1 1] or exponentially small additive error [9]. 

Approximation of general IQP circuits - We first prove a 
key technical ingredient, which relates approximate sampling 
from the output distributions of IQP circuits to approximating 
individual output probabilities. This is essentially the same 
argument as used in [4] for the permanent, although we be¬ 
lieve it becomes substantially simpler in the setting of IQP. 
The intuition behind this result is that adding random X gates 
to an IQP circuit randomly permutes the output probabilities. 
This allows the user of a sampler which is accurate for all cir¬ 
cuits to obfuscate from the sampler which one of the output 
probabilities the user is interested in. 

Lemma 4. Let C be an arbitrary IQP circuit on n qubits. Let 
Cx, for X S {0,1}", be the circuit produced by appending an 
X gate to C for each i such that Xt = 1. Assume there exists 


a classical polynomial-time algorithm A which, for any IQP 
circuit C, can sample from a probability distribution which 
approximates the output probability distribution of C up to 
additive error e in l\ norm. Then, for any 5 such that 0 < 
(5 < 1, there is a FBPP^^ algorithm which, given access to 
A, approximates |(0|Ca;|0)p up to additive error 

0((1 + o(l))e/(2"<5) + |(0|C|0)|Vpoly(n)) 

with probability at least 1 — (5 (over the choice of x). 

Proof. For each x,y G {0,1}", set 

Pxy ■■= Pi[Cx outputs y],qxy := Pr[v4 outputs y on input Cx], 

where in both cases the probability is taken over the algo¬ 
rithm’s internal randomness. For any y of our choice, we 
can apply Stockmeyer’s Counting Theorem (see Appendix E) 
to estimate q^y (where we write 0 for 0"). This gives us an 
FBPpNP algorithm which produces an estimate fy such that 

\qy - qOy\ < qoy/ poly(n). 

Then 

I Qy ~ Poy I ^ 1~ 90y I + I QOy ~ POy I 

< qoy/ poly(n) -f \qoy - poy\ 

< {Poy + koy - P0y\)/ poly(n) -f \qoy - P 0 y\ 

= Poy/ poly(n) -f \qoy-poy\{l + 1/poly(n)). 

As A approximates the output probability distribution of Co 
up to £i error e, it follows from Markov’s inequality that 

Pr[|poy - qoy\ > e/(2”^)] < S 

for any 0 < <5 < 1, where y is picked uniformly at random. 
Thus 

/ N e(l + l/poly(n)) 

\qy-P0y \ < Poy/po\y{n) + - - — - 

with probability at least 1 — <5, over the choice of y. But 

Poy = Pr[Co outputs y] = |(y|Co|0)p = |(0|Cj;|0)p. 

This completes the proof. □ 

If |(0|Ca;|0)p = H(2“"'), the algorithm of Lemma 4 gives 
a good approximation - i.e. a multiplicative approximation to 
within roughly 0(e). We state this formally, and calculate the 
precise constants involved, in Appendix E. 

We next show that this condition is indeed satisfied for two 
interesting families of IQP circuits. 

Anticoncentration bounds - Fix a family (F of IQP cir¬ 
cuits. We would like to show that |(0|C|0)p is likely to be 
high for a circuit C formed by picking a random circuit T) from 
A, then appending X gates on a uniformly random subset S 
of the qubits. We will use the following fact; 

Fact 5 (Paley-Zygmund inequality). If R is a non-negative 
random variable with finite variance, then for any 0 < a < 1, 
Pr[R > aE[i?]] > (1 - a)2E[i?]VE[i?2]. 
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We will apply Fact 5 to the random variable i? = |(0|C|0)p, 
first observing that 

Ec|K0|C|0)|“| = E„,,|Ki|U|O)|»| 

= 4^1, y: K*ii>io)r = 4, 

xG{0,l}" 

where in the second expectation x is picked uniformly at ran¬ 
dom from {0,1}". This deals with the numerator; to handle 
the denominator, we need to upper-bound E[|(0|C|0) |^]. 

The hrst family of circuits we consider, C/, corresponds 
to polynomials over F 2 . We prove in Appendix F that for 
uniformly random degree-3 polynomials /, Ey [ngap(/)'^] < 
3 • 2“^". Based on this, and the tight connection between IQP 
circuits over the gate set {Z, CZ, CCZ} and degree-3 polyno¬ 
mials, we have the following result: 

Theorem 6. Assume there exists a classical polynomial-time 
algorithm A which, for any IQP circuit C, can sample from a 
probability distribution which approximates the output prob¬ 
ability distribution of C up to additive error 1/192 in £1 
norm. Then there is an FBPP^^ algorithm which, given ac¬ 
cess to A, approximates ngap(/)^ up to multiplicative error 
1/4-1- 0 ( 1 ) on at least a 1/24, fraction of degree-3 polynomials 
/: { 0 , 1 }" ^{ 0 , 1 }. 

Proof. Combining Fact 5 and the bound on E/[ngap(/)‘*], we 
have Prj[ngap(/)^ > a/2”] > (1 — a)^/3 for any 0 < a < 
1. Fixing a = 1/2, we get Pr/[ngap(/)^ > 2“”“^] > 1/12. 
The claim then follows from the discussion above (where the 
precise parameter values stated in the theorem follow from 
Corollary 10 in Appendix E). □ 

We next consider the Ising model, where we are inter¬ 
ested in evaluating the partition function Zn for a randomly 
weighted graph (see (1)). Recall each edge of the complete 
graph has a weight Wij, and each vertex has a weight Vk, each 
picked uniformly at random from the set {0,. .., 7}. 

We show in Appendix F that (0|C/|0) = Zi^/2" for an IQP 
circuit Cl whose diagonal component is picked from the set 
{diag(l, 1,1, f), diag(l, e”/^)} (up to trivial phase factors); 
and further that we can consider a random circuit of this form 
as being chosen by picking a random circuit using this gate 
set, then following it by a random choice of X gates. In ad¬ 
dition, Eu,^„ < 3 • 2^". Via Fact 5 this implies the 

following result, whose proof is essentially the same as that of 
Theorem 6: 

Theorem 7. Assume there exists a classical polynomial-time 
algorithm A which, for any IQP circuit C, can sample from a 
probability distribution which approximates the output prob¬ 
ability distribution ofC up to additive error 1/192 in Ii norm. 
Then there is a FBPP^^ algorithm which, given access to A, 
approximates jZ/jp up to multiplicative error l/4-|-o(l) with 
probability at least 1/24 (over the choice of weights). 

Combining Theorems 6 and 7 gives our main result. Theo¬ 
rem 1. 

Implementation and outlook - We have argued that the 
following ’simple’ quantum algorithm should be classically 


intractable: ( 1 ) preparing the computational basis state |0)®", 

(2) evolving by a circuit, or equivalent Hamiltonian, randomly 
drawn from either Cj (e.g. see Figure 1) or Cf, (3) measuring 
all n qubits in the computational basis, and (4) repeating (1)- 

(3) polynomially many times. By ‘classically intractable’ we 
mean that if this process can be demonstrated in the labora¬ 
tory, if the total effect of all errors can be demonstrated to 
remain consistently below 1/192 (in i\ distance) even as the 
complexity parameter increases, and if the resources (time) 
the experiment takes can be argued to grow only polynomially 
with the complexity parameter, then the process is actively ev¬ 
idencing violation of the extended Church-Turing thesis. Note 
also that it doesn’t even matter what is the origin of random¬ 
ness in step (2), provided that the sampled circuits (Hamilto¬ 
nians) are independent and correctly distributed, and known 
to the experimenter by the end of the experiment. 

For both the Ising model (C/) and degree-3 polynomial (C/) 
case the most obvious experimental implementations require 
non-local gates, which is quite challenging. In terms of the 
Ising model case 2-qubit interactions might need to be gener¬ 
ated between any two qubits in a system. Such interactions do 
not arise naturally in lattice geometries and as such will need 
to be engineered. From an experimental perspective there has 
already been significant progress in these directions. The dy¬ 
namics of the Ising model with local interactions have been 
digitally simulated in ion traps [16, 17] and very recently non¬ 
local interactions have been utilised in the digital simulation 
of fermionic systems with superconductors [18]. As technolo¬ 
gies such as cavity buses for superconducting systems [19] 
become more reliable, we expect that an increasing number 
of systems will be able to implement IQP circuits in a regime 
that is likely not to be classically simulable. 

Theoretically there are a number of natural questions that 
remain to be answered, the most obvious of which is whether 
or not Conjectures 2 and 3 are true. To the best of our knowl¬ 
edge there are no known techniques that are capable of lifting 
the known worst-case hardness results for the Ising model and 
gaps of degree-3 polynomials to average-case results. How¬ 
ever, recent breakthroughs [20-22] in categorising the com¬ 
plexity of statistical mechanical systems via the underlying 
interaction graph properties give some hope that these conjec¬ 
tures can be resolved. 


As well as the connections used here between IQP, the Ising 
model and low-degree polynomials, it is known that IQP cir¬ 
cuits are closely related to Tutte polynomials and weight enu¬ 
merator polynomials of binary linear codes [7]. It is a com¬ 
pelling question as to whether the ideas developed here can 
be extended to these models. It would also be very interesting 
to explore the connection between nonadaptive measurement- 
based quantum computing and IQP [23, 24] in order to find 
subclasses of IQP that are physically straightforward to im¬ 
plement, and for which one can prove conditional hardness 
results similar to those shown here. 
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Appendix A: The Ising model and IQP circuits 


Consider the general Ising model; 


Hi = '^ WijZiZj + ^ v^Zi 
i<j i 

where z G { — 1, +1}", i,j label vertices in the complete graph, Wij is a weight assigned to the edge {i,j) and Vi is a weight 
assigned to the vertex i. We want to show that the partition function of Hj evaluated at e*®, Z = Tr[e®®^^], is proportional to an 
amplitude of an n-qubit IQP circuit. 

Imagine we have an IQP circuit constructed from the gates and and consider the circuit amplitude 


where X is a Pauli-X operator. Then 


( 0 | 

1 

2 ” 

1 

2 ” 

1 

2 ” 

1 

2 " 


0n^0ngiS(Ei<j ’'i | 0n 

a:,ye{0.1}’* 

Y I’d-!)"*) 

a:G{0,l}" 


E 

ZG{-1,1}" 


g*®(Ei<i WijZiZj+Y,i ViZi) 


Tr[e*®^^]. 


If we consider IQP circuits constructed from the gates e® * and e® ” then it is clear that amplitudes of such circuits give 
rise to partition functions of the form Z{uj) = Tr[u;^®] where w = e®? and Wij,Vi G {0,... ,2t — 1}. 

See the hnal paragraph of Appendix F below for an alternative connection between IQP and the Ising model using a different 
gate set. 


Appendix B: Gaps of degree-3 polynomials 


We can also use IQP circuit amplitudes to express the gap of any degree-3 polynomial over F 2 (with no constant term), 

/: { 0 , 1 }®® ^{ 0 , 1 }: 


f{x) = Y aijkXiXjXk 


■ Y PijXiXj + Yj 


i,j,k 


where aijk,Pij,^i G {0,1}. 

This can be seen by noting the action of the Z, CZ, and CCZ gates on the computational basis states. Given a single qubit 
in a computational basis state, jcci), the Pauli-Z gate has action Z\x\) = (—l)®®|a;i). Similarly we see CZyi\x\X’^ = 
{—lY^^'^\xiX 2 ) and CCZi 2 ^\xiX 2 X'i) = {—lY^^^^^\xiX 2 xY}- Then, in order to generate the phase (—|x), we sim¬ 
ply apply for each non-zero aijk, f3ij,% in / a corresponding CCZ, CZ, or Z gate to the n-qubit computational basis state, |x). 
Let Cf denote this circuit and C/ = denote its Hadamard transform, which is an IQP circuit. 

We want to show that (0|®"C/|0)®’® is proportional to the gap of /. This is straightforward; 

(0rff®®®C/if®"|0)®®® = ^ ^ {y\Cf\x) = ^ Y (-l/^"^ = ^gap(/), 

2:.yG{0,l}" xG{0,l}" 

recalling that gap(/) is dehned as gap(/) ;= |{a: ; f{x) = 0}| — |{a; ; f{x) = 1}|. Note that similar ideas were previously 
used in [25, 26] for different classes of circuits. 
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Appendix C: The Hadamard gadget 

Arbitrary Hadamard operations can be implemented in IQP using post-selection [3] - something that cannot be done efficiently 
in physical systems but nonetheless turns out to be useful as a mathematical tool. We perform Hadamard gates by introducing 
Hadamard gadgets to our IQP circuits. Imagine that we have an n-qubit state \ijj) upon which we wish to apply a Hadamard 
gate to qubit j, and denote this by Hj\tj}). We now add an extra qubit e initialised to the state He\0)e, recalling that all lines of 
an IQP circuit in the Z basis begin and end with a H. Then we perform some gates to produce the state HjCZjeHe\'ip)\Q)f, and 
measure qubit j in the computational basis, post-selecting on the 0 outcome. We note that the gate Hj must be present as this is 
an IQP circuit. It is easily checked that the effect of this protocol is to teleport the state of qubit j to qubit e while performing a 
Hadamard operation on this qubit. If we had desired to perform more gates on qubit j we now perform them on qubit e. 

There are a few important things to note about the Hadamard gadget. Firstly for each “intermediate” Hadamard to be per¬ 
formed there is a cost of 1 qubit, 1 CZ gate, and 1 qubit of post-selection. Secondly, if we did not perform post-selection there 
would be a probability of 1/2 for this procedure to implement a Hadamard gate, so if a circuit had m intermediate Hadamard 
gates the success probability would be 1 / 2 "*, making this procedure impractical. 

Finally, it is clear that the Hadamard gadget preserves multiplicative approximations of circuit amplitudes. Imagine we had 
an n-qubit quantum circuit U which is expressed in terms of gates that are diagonal in the Z basis and m intermediate H gates. 
Then using the Hadamard gadget m times we get the IQP circuit C such that (0|®"Z^|0)®" = 

Furthermore, if we had a multiplicative approximation. A, to this latter quantity within multiplicative error 7 then \A — 

I < Then it is clear that Jf = 2”*/^A also provides a multiplicative approxima¬ 

tion to ( 0 |®"Z//| 0 )®" within 7 . 


Appendix D: Hardness of multiplicative approximations 


We now show that approximating the squared gap of a degree-3 polynomial over F 2 is GapP-complete, even up to constant 
multiplicative error. GapP is a complexity class containing #P [27]. The majority of the proof is very similar to arguments used 
in other settings, such as for the permanent [28] or the Ising model [11]. However, we believe that the connection to IQP again 
somewhat simplihes the argument. A similar argument could be used to prove hardness of multiplicative approximation for the 
Ising model; we omit this as it was shown in [11]. 

Proposition 8. Let f be a degree-3 polynomial over F 2 . The problem of producing an estimate z such that || ngap(/)| — z\ < 
e| ngap(/)|, /or any e < 1/2, is GwpP-complete. 

Proof. Let / : {0,1}" —> {0,1} be a function described by a polynomial-size classical circuit C. By dehnition, computing 
ngap(/) for arbitrary functions / is GapP-complete [27]. We now show that this problem can be reduced to approximating 
I ngap(/)| for degree-3 polynomials /, up to sufficiently high precision. 

The hrst step is to show a connection between a “shifted” version of the general problem and IQP. For any m = 0{n) and 
for any c G [— 1 , 1 ] such that c is an integer multiple of 2 ^“"*, there is a polynomial-size classical circuit Dc on m input bits 
computing a function g such that ngap(p) = — c. By adding a control bit which determines whether to execute C or Df., we 
obtain a polynomial-size classical circuit on n -f m -I- 1 bits computing a function fc such that ngap(/c) = |(ngap(/) — c). 

By universality of the Toffoli gate for reversible classical computation, we can write down a quantum circuit Qc consisting of 
Toffoli, CNOT and X gates such that Qc performs the map 

| 0 )®“|x)| 0 )^| 0 )®“|x)|/e(x)), 

where the hrst register contains a ancilla qubits, with a = poly(n). Let the circuit Q/ be dehned as follows: start in the state 
10)0010)®!”+”^+!) |0); apply an X gate to the third register; apply Hadamard gates to the second and third registers; execute Qd 
apply Hadamard and X gates to the third register; and hnally apply Hadamard gates to the second register. The state near the 
end of this circuit, just before the last Hadamard gates are applied, is 


| 0 ) 


®o ( ^ 

.^/on+m+l 


(_l)/cG)|^) 


| 0 ). 


Therefore, (0|(5/|0) = ngap(/c) = ^(ngap(/) — c), where we henceforth abbreviate |0)®" = |0) for any integer n. As 
discussed in Appendix C, there exists an IQP circuit Q” such that (0|Q[.|0) = a(0|Q/|0) for some easily computed real number 
a. An approximation of (0|(5/|0) up to multiplicative error e therefore implies an approximation of (0|Q/|0) up to the same 
error. 

Assume we have a deterministic algorithm A such that, on taking as input an arbitrary IQP circuit C, A outputs z such that 
11 (01(710)1 — z| < e|(0|(7|0) |, for some e < 1. We will use A to output estimates d such that |d— | ngap(/) —c|| < e| ngap(/) —c|. 
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Observe that A can be used to distinguish with certainty between the two cases that c = ngap(/), and c 7 ^ ngap(/). So if we 
can guess c = ngap(/), A certifies that our guess is correct. 

We now perform the following sequence of steps to compute ngap(/). At each step, we have a guess c for ngap(/), starting 
with c = 0. We use A to output an estimate d of | ngap(/) — c|. We then consider the two possibilities c± d. We apply A to 
estimate | ngap(/) — (c± d)|, obtaining outputs d'^, d~, and choose as our new value of c either c + d (if d^ < d~) or otherwise 
c — d. We then repeat until c = ngap(/). 

Write d = (1 + 7 )|c — ngap(/)|, for some 7 such that I 7 I < e. If c < ngap(/), we have 

|c + d- ngap(/)| = |c+ (1 + 7 )(ngap(/) - c) - ngap(/)| = | 7 (ngap(/) - c)| < e|c - ngap(/)|, 

so if we choose c + d for the next step, the distance between c and ngap(/) is reduced by multiplying it by a factor smaller than 
e. A similar calculation holds in the case c > ngap(/) if we choose c — d for the next step. As ngap(/) is an integer multiple 
of 2“", if we pick the correct choice at each step, we need only 0{n) steps to obtain c = ngap(/). We now show that, for 
sufficiently small e, the correct choice is indeed picked. 

Assuming c < ngap(/), we would like d’*' < d~. This will hold if 

(1 + e)|c + d - ngap(/)| < (1 - e)|c - d - ngap(/)| 

(1 + e)|c+ (1 + 7 )|c- ngap(/)| - ngap(/)| < (1 - e)|c- (1 + 7 )|c - ngap(/)| - ngap(/)| 

<^(l + e)| 7 (ngap(/)-c)| < (1 - e )|(2 + 7 )(ngap(/) - c)| 

(l + e)|7l < (l-e)|2 + 7|. 

This inequality is easily seen to hold for all 7 such that I 7 I < e < 1/2. The case c > ngap(/) is similar. 

One omission in this argument is that we can only approximate | ngap(/) — c| for values c which are integer multiples of 
2 i-m, depending on the estimates output by A, we may want to use values of c which are not integer multiples. In this case, 
we simply truncate c to the nearest integer multiple of 2^“™. For sufficiently large m = 0{n), the additional error introduced 
by this truncation is negligibly small. □ 

This immediately implies hardness of multiplicatively approximating ngap(/)^ to the same accuracy, because 

|ngap(/)^ < engap(/)^ ||ngap(/)| - z|(| ngap(/)| + < engap(/)^ => ||ngap(/)| -I\< e|ngap(/)|. 


Appendix E: From additive to multiplicative error 

An essential ingredient of our argument connecting sampling with additive and multiplicative error (Lemma 4) is a classic 
result of complexity theory, the so-called Stockmeyer Counting Theorem. Informally it states that for every function inside #P, 
there is a good multiplicative approximation within FBPP^^; 

Theorem 9 (Stockmeyer [15], see [4] for statement here). There exists an FBPP'^^ machine which, for any boolean function 
f : {0,1}" —?► {0,1}, can approximate 


p = Pjlfix) = 1] = ^ 

a:G{0,l}" 

to within a multiplicative factor 0 / (1 + e) for all e = PI{1/ poly(n)), given oracle access to f. 

We also include here a corollary of Lemma 4, which formalises the discussion in the main text. 

Corollary 10. Let A be a family of IQP circuits on n qubits. Pick a random circuit C by choosing a circuit from J- uniformly 
at random, then appending X gates on a uniformly random subset of the qubits. Assume that there exist universal constants 
a,p > 0 such that Pr[|(0|C|0)p > a ■ 2“"] > p. Further assume there exists a classical polynomial-time algorithm A which, 
for any IQP circuit C, can sample from a probability distribution which approximates the output probability distribution of C 
up to additive error e = ap/8 in norm. Then there is a FBPP^^ algorithm which, given access to A, approximates \ (0|C|0) p 
up to multiplicative error 1/4 + o(l) on at least a p/2 fraction of circuits C. 

Proof. With probability at least p over the choice of C, |(0|C|0)p > a ■ 2“". Setting e = ap/8, 5 = p/2 in Lemma 4, there 
is a FBPP^^ algorithm which, given access to A, approximates |( 0 |C| 0 )p up to additive error 0((1 + o(l))a • 2 “”“^ + 
|(0|C|0)p/poly(n)) with probability at least 1 — p/2 (over the choice of C). Therefore, with probability at least p/2, the 
algorithm approximates |(0|C|0)p up to multiplicative error 1/4 + o(l). □ 
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Appendix F: Proofs of anticoncentration bounds 


Here we prove the lemmas required for the anticoncentration bounds claimed in the main body of the paper. Our main 
technical tool will be the following result: 

Lemma 11. Let uj = p = ^ for some integers r and s such that r, s > 2, and if s = 2 then r = 2. Fix integer n. 

For pairs of integers i < j between 1 and n, let aij be picked uniformly at random from {0,..., r — 1}. For fc S n}, let 

fik be picked uniformly at random from {0,..., s — 1}. Then 


w ,x 


En 


w 


T,i<i aijiwiWj+XiXj-yiVj-ZiZj) 


Efi 


J2k Pk(wk+xk-yk-zk) 


<3-2^ 


Proof. Each term in the sum is clearly upper-bounded by 1. Our goal will be to show that many terms in the sum are actually 
zero, using the identities Ea[a;“*] = 0 for any integer f ^ 0 mod r, and similarly E^[ 77 ^*] = 0 for f ^ 0 mod s. First, 


E/3 


f^Zk 0k{wk+xk-yk-^k) 


J|E^, [rjMwk+Xk-yk-^k^j^ 
k=l 


which equals 0 unless z = w + x — y mod s. If this is the case, it also holds that z = w + x — y mod r. To see this, observe 
that for s > 3, as ui -I- a; — y S { — 1,0,1, 2}”, z = w + x — y mod s implies that in fact z = w + x — y. If s = 2, then r = s by 
assumption and the claim is immediate. Hence 


En 


,• OLij{wiWj-\-XiXj—yiyj—ZiZj) 


= En 


aij{wiWj+XiXj-yiyj-(w+x-y)i{w+x-y)j) 


=nE, 


^Oiij {Wi (yj-Xj)+Xi (yj -Wj)+yi (wj +Xj )-2yiyj ) 


We claim that if w, x and y are all distinct, then there exists a pair {i,j) (also distinct) such that 


w^{yj - Xj) + Xi{yj - Wj) + yi{wj + Xj) ^ 2y^yj mod r, (FI) 

which implies that the product evaluates to 0. Since w x, let i be such that Wi fz Xi. We may assume without loss of generality 
that Wi = 0 and Xi = 1, since the other case just relabels w for x and vice versa. Therefore it remains to find a j > i such that 


yj - Wj + yi{wj + Xj) ft 2y.,yj mod r. 


(F2) 


In fact, finding a j < i is just as good, because the expression (FI) is also symmetric under exchange of i and j. If = 0 then 
since y f w, there must exist some j such that yj f wj. Moreover, j f i because yj cannot differ from both Wi and Xi (which 
we have already seen are different). So yj = 0, Wj = 1 (or vice versa), they cannot be equivalent modulo r, and (F2) holds in 
this case. On the other hand, if y, = 1 then since y f x, there must be some j such that yj f Xj, and j f i because we already 
chose Xi = 1. So yj = 0, Xj = 1 (or vice versa), they are not equivalent modulo r, and (F2) holds in this case too. 

We have therefore shown that each term in the sum in the statement of the lemma evaluates to 0 unless both z = w + x — y 
mod s, and also w = x, w = y or x = y. The number of ways of choosing strings w, x, y, z to comply with this constraint is at 
most 3 • 2^". This completes the proof. □ 


We first apply Lemma 11 to random degree-3 polynomials. A degree-3 polynomial / : {0,1}" —> {0,1} can be picked 
uniformly at random in a straightforward manner. Assuming that /(O”) = 0 without loss of generality and writing 

f [x) ^ ^ CTiji^XiXjXi^ -f 'y ^ fdjjXjXj T y ^ 

i,j,k i,j i 

where onjk, Pij^^i G {0,1}, we simply pick each of these coefficients uniformly at random. Observe that the random ji 
coefficients correspond to applying X gates to a random subset of the qubits. We now show that, for each possible choice of the 
aijk coefficients, the expected value of ngap(/)"‘ (taken over the (3, 7 coefficients) is low. 

Lemma 12. Let f : {0,1}” — > {0,1} be a polynomial over F 2 whose degree < 2 part is uniformly random. Then 
E/[ngap(/)4] <3-2-2". 
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Proof. We have 


Ef [ngap(/)^] = Ef 

= E/ 

= E„ 


(e. 


'a:G{0,l}' 




x) 


F rn -,1 (—^\f('^) + f(^) + f(■y')+f(^) 

^w,x,y,ze{0,l}^ I -*-1 


,x,y,2G{0,l}^Ej 


(-!)/(■ 


■w)+f(x) + f{y)+f(z) 


Let /<2 and />2 be the parts of / of degree < 2 and degree > 2, respectively. Then 


E/ 


(-!)/( 


w) + f{x)+f{y)+f(z) 


= (^_2)/>2(’") + />2(“) + />2(y)+/>2(z)£^ (^_iy<2{w) + f<2{x) + f<2iy)+f<2iz 


Expanding f< 2 {x) = j PijXiXj + IkXk, the expectation in this expression can be written as 


E 


P,i 


PijiwiWj+XiXj+yiyj+ZiZj)+J2k 'Tki'Wk+Xk+yk+Zk) 


So 


Ef [ngap(/)^] < ^ ^ 

w,x,y,z^{0,l}^ 


E/q 


(-1) 


T,i.i Pij (wiWj+XiXj+yiyj+ZiZj 


E.. 


(- 1 ) 


J2k JkiWk+Xk+yk+Zk) 


<3-2- 


by Lemma 11 . 


□ 


Next we consider the partition function (1) of the Ising model for random weights Wij,Vk S {0,..., 7}, evaluated at w = 
To make contact with the previous analysis, and with IQP circuits, we rewrite the expression (1) for Z{lo) as 

Z{ljj) = ^ ^T.i<jWij{l-2xi)[l-2xj)+Y,k=i'^k(l-'2xk) 

xGlO,!}" 

— ^T,i<jW^j+T,k=l^"k ^2 ijj^'Z,i<j‘Wijx,xj+2j2k=iPk^k ^ 

xG{0,l}^ 


where = —Vk — J2j^k '^jk- Observe that v'^ is uniformly random mod 8. Up to an easily computed phase, we can write 

Z{uj)= '^2 

a:G{0.1}’* 

Then it is clear that Z(yi)lZ^ = (0|®”C/|0)®"' for an IQP circuit C/ consisting of gates from the set 

{diag(l, 1,1, i), diag(l, Further, because of the uniformly random choice of w and v', we can consider such a cir¬ 

cuit as being formed by picking a random circuit using this gate set, then following it by a random choice of X gates. It follows 
immediately from Lemma 11 that Eu,_„/ [|X(tLi)|^] < 3 • 2^". Finally, note that we could in fact have picked the Wij weights 
uniformly from the set {0,..., 3} without affecting the above analysis. 




















